diff --git a/server/internal/config/config.go b/server/internal/config/config.go
index 33871fe..9be5052 100644
--- a/server/internal/config/config.go
+++ b/server/internal/config/config.go
@@ -169,7 +169,9 @@ func applyDefaults(v *viper.Viper) {
 	v.SetDefault("server.trusted_proxies", []string{"127.0.0.1", "::1"})
 	v.SetDefault("server.web_root", "")
 	v.SetDefault("database.path", "./data/backupx.db")
+	v.SetDefault("security.jwt_secret", "")
 	v.SetDefault("security.jwt_expire", "24h")
+	v.SetDefault("security.encryption_key", "")
 	v.SetDefault("backup.temp_dir", "/tmp/backupx")
 	v.SetDefault("backup.max_concurrent", 2)
 	v.SetDefault("backup.retries", 10)
diff --git a/server/internal/config/config_test.go b/server/internal/config/config_test.go
index 3e59894..a0fe67a 100644
--- a/server/internal/config/config_test.go
+++ b/server/internal/config/config_test.go
@@ -72,6 +72,22 @@ func TestLoadReadsServerExternalURLFromEnv(t *testing.T) {
 	}
 }
 
+func TestLoadReadsSecuritySecretsFromEnv(t *testing.T) {
+	t.Setenv("BACKUPX_SECURITY_JWT_SECRET", "test-jwt-secret")
+	t.Setenv("BACKUPX_SECURITY_ENCRYPTION_KEY", "test-encryption-key")
+
+	cfg, err := Load("")
+	if err != nil {
+		t.Fatalf("Load returned error: %v", err)
+	}
+	if cfg.Security.JWTSecret != "test-jwt-secret" {
+		t.Fatalf("expected JWT secret from env, got %q", cfg.Security.JWTSecret)
+	}
+	if cfg.Security.EncryptionKey != "test-encryption-key" {
+		t.Fatalf("expected encryption key from env, got %q", cfg.Security.EncryptionKey)
+	}
+}
+
 func TestLoadReadsTrustedProxiesFromEnv(t *testing.T) {
 	t.Setenv("BACKUPX_SERVER_TRUSTED_PROXIES", "127.0.0.1,172.18.0.0/16")
 	cfg, err := Load("")